Merge remote-tracking branch 'php/master'

5 files changed, 31 insertions, 10 deletions

diff --git a/NEWS b/NEWS
index 190de8fe13..307e0deddc 100644
--- a/NEWS
+++ b/NEWS
@@ -25,4 +25,7 @@ PHP                                                                        NEWS
 - XSL:
   . Fixed bug #64776 (The XSLT extension is not thread safe). (Mike)
 
+- GD:
+  . Made fontFetch's path parser thread-safe. (Sara)
+
 <<< NOTE: Insert NEWS from last stable release here prior to actual release! >>>
diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
index be01accf6a..9186b96c82 100644
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@@ -4547,7 +4547,10 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
 					ZVAL_UNREF(array_ref);
 					array_ptr = array_ref;
 				}
-				if (Z_IMMUTABLE_P(array_ptr)) {
+				if (Z_IMMUTABLE_P(array_ptr) ||
+				    (Z_ISREF_P(array_ref) &&
+				     Z_REFCOUNTED_P(array_ptr) &&
+				     Z_REFCOUNT_P(array_ptr) > 1)) {
 					zval_copy_ctor(array_ptr);
 				}
 				Z_ADDREF_P(array_ref);
diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
index 9bc2c13c30..430f10ba00 100644
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@@ -3161,7 +3161,10 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_A
 					ZVAL_UNREF(array_ref);
 					array_ptr = array_ref;
 				}
-				if (Z_IMMUTABLE_P(array_ptr)) {
+				if (Z_IMMUTABLE_P(array_ptr) ||
+				    (Z_ISREF_P(array_ref) &&
+				     Z_REFCOUNTED_P(array_ptr) &&
+				     Z_REFCOUNT_P(array_ptr) > 1)) {
 					zval_copy_ctor(array_ptr);
 				}
 				Z_ADDREF_P(array_ref);
@@ -8678,7 +8681,10 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARG
 					ZVAL_UNREF(array_ref);
 					array_ptr = array_ref;
 				}
-				if (Z_IMMUTABLE_P(array_ptr)) {
+				if (Z_IMMUTABLE_P(array_ptr) ||
+				    (Z_ISREF_P(array_ref) &&
+				     Z_REFCOUNTED_P(array_ptr) &&
+				     Z_REFCOUNT_P(array_ptr) > 1)) {
 					zval_copy_ctor(array_ptr);
 				}
 				Z_ADDREF_P(array_ref);
@@ -14118,7 +14124,10 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARG
 					ZVAL_UNREF(array_ref);
 					array_ptr = array_ref;
 				}
-				if (Z_IMMUTABLE_P(array_ptr)) {
+				if (Z_IMMUTABLE_P(array_ptr) ||
+				    (Z_ISREF_P(array_ref) &&
+				     Z_REFCOUNTED_P(array_ptr) &&
+				     Z_REFCOUNT_P(array_ptr) > 1)) {
 					zval_copy_ctor(array_ptr);
 				}
 				Z_ADDREF_P(array_ref);
@@ -31476,7 +31485,10 @@ static int ZEND_FASTCALL  ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS
 					ZVAL_UNREF(array_ref);
 					array_ptr = array_ref;
 				}
-				if (Z_IMMUTABLE_P(array_ptr)) {
+				if (Z_IMMUTABLE_P(array_ptr) ||
+				    (Z_ISREF_P(array_ref) &&
+				     Z_REFCOUNTED_P(array_ptr) &&
+				     Z_REFCOUNT_P(array_ptr) > 1)) {
 					zval_copy_ctor(array_ptr);
 				}
 				Z_ADDREF_P(array_ref);
diff --git a/ext/gd/libgd/gdft.c b/ext/gd/libgd/gdft.c
index 4979e1511f..4148cf47bb 100644
--- a/ext/gd/libgd/gdft.c
+++ b/ext/gd/libgd/gdft.c
@@ -390,9 +390,10 @@ static void *fontFetch (char **error, void *key)
 	fontlist = gdEstrdup(a->fontlist);
 
 	/*
-	 * Must use gd_strtok_r else pointer corrupted by strtok in nested loop.
+	 * Must use gd_strtok_r becasuse strtok() isn't thread safe
 	 */
 	for (name = gd_strtok_r (fontlist, LISTSEPARATOR, &strtok_ptr); name; name = gd_strtok_r (0, LISTSEPARATOR, &strtok_ptr)) {
+		char *strtok_ptr_path;
 		/* make a fresh copy each time - strtok corrupts it. */
 		path = gdEstrdup (fontsearchpath);
 
@@ -408,7 +409,8 @@ static void *fontFetch (char **error, void *key)
 				break;
 			}
 		}
-		for (dir = strtok (path, PATHSEPARATOR); dir; dir = strtok (0, PATHSEPARATOR)) {
+		for (dir = gd_strtok_r (path, PATHSEPARATOR, &strtok_ptr_path); dir;
+		     dir = gd_strtok_r (0, PATHSEPARATOR, &strtok_ptr_path)) {
 			if (!strcmp(dir, ".")) {
 				TSRMLS_FETCH();
 #if HAVE_GETCWD
diff --git a/ext/session/session.c b/ext/session/session.c
index a7b79c2300..8811a08caf 100644
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -1266,12 +1266,13 @@ static void php_session_remove_cookie(TSRMLS_D) {
 	zend_llist *l = &SG(sapi_headers).headers;
 	zend_llist_element *next;
 	zend_llist_element *current;
-	char *session_cookie, *e_session_name;
+	char *session_cookie;
+	zend_string *e_session_name;
 	int session_cookie_len, len = sizeof("Set-Cookie")-1;
 
 	e_session_name = php_url_encode(PS(session_name), strlen(PS(session_name)));
-	spprintf(&session_cookie, 0, "Set-Cookie: %s=", e_session_name);
-	efree(e_session_name);
+	spprintf(&session_cookie, 0, "Set-Cookie: %s=", e_session_name->val);
+	STR_FREE(e_session_name);
 
 	session_cookie_len = strlen(session_cookie);
 	current = l->head;